{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  bpf,fork: wipe -\u003ebpf_storage before bailouts that access it  Currently, copy_process() can bail out to free_task() before p-\u003ebpf_storage has been initialized, with this call graph (shown here for the !CONFIG_MEMCG case):  copy_process   dup_task_struct     arch_dup_task_struct       [copies the entire task_struct, including -\u003ebpf_storage member]   [RLIMIT_NPROC check fails]   delayed_free_task     free_task       bpf_task_storage_free         rcu_dereference(task-\u003ebpf_storage)         bpf_local_storage_destroy  In this case, the nascent task's -\u003ebpf_storage member that bpf_local_storage_destroy() operates on is a plain copy of the parent's -\u003ebpf_storage pointer, not a real initialized pointer. This leads to badness (kernel hangs, UAF).  This is reachable as long as the process calling fork() has been inserted into a task storage map.",
  "id": "DEBIAN-CVE-2026-72110",
  "modified": "2026-09-14T16:47:43.778088923Z",
  "published": "2026-08-15T06:21:25.320Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72110"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-72110"
  ]
}